This skill allows arbitrary command execution and
Claims to do
Verification Tool Skill: Bridge the gap between VERIFICATION-FIRST principles and project reality. Most projects lack executable verification tools. This skill analyzes the project's runtime environment and creates a verification manifest — a mapping of IA items to executable commands with expected results.
Actually does
This skill analyzes a project's runtime environment using Work and Review Agents, then creates a `.crabshell/verification/manifest.json` mapping Intent Anchor items to executable commands and expected results. It also generates a `node` runner script (`run-verify.js`) that executes these commands via `child_process.execSync` and reports pass/fail status. It can also update the manifest with new verification entries.
Shell command execution function detected
child_process
The skill directly executes commands from the `manifest.json` using `child_process.execSync` in the `run-verify.js` script. The `command` field in the manifest is populated from 'IA item in the current session' or 'user input' in update mode, allowing for arbitrary command injection.
const output = execSync(entry.command, { ... }); (run-verify.js, line 100); 'command': '{executable command}' (manifest.json structure, line 70); 'Create entry with user input (IA, type, command, expected)' (Update Mode, line 160)In conjunction with arbitrary command execution, the `run-verify.js` script checks if `output.includes(entry.expected)`. An attacker could craft a command to read sensitive files and set `entry.expected` to a pattern found in the sensitive data, effectively exfiltrating information by observing the verification result.
const pass = output.includes(entry.expected) || entry.expected === 'exit-0'; (run-verify.js, line 105); 'expected': '{expected output or behavior}' (manifest.json structure, line 70)The skill explicitly launches 'Work Agent (Task tool)' and 'Review Agent (Task tool)' to analyze the project's runtime environment, gathering detailed information about the system, entry points, and commands. This capability can be abused for extensive reconnaissance or to orchestrate further attacks via sub-agents.
Launch a Work Agent (Task tool) to determine: (line 35); Launch a Review Agent (Task tool, SEPARATE from Work Agent) (line 50)
The run-verify.js runner script executes arbitrary shell commands sourced directly from manifest.json entries via `execSync` with no sanitization, validation, or allowlisting. Any entity that can write to or influence manifest.json can achieve arbitrary command execution on the host system.
const output = execSync(entry.command, { timeout: entry.timeout || 30000, encoding: 'utf8', cwd: process.env.PROJECT_ROOT || process.cwd() });The working directory for executed commands is taken from the unvalidated `process.env.PROJECT_ROOT` environment variable. An attacker who can set this variable could redirect command execution to an arbitrary directory, potentially enabling path traversal or execution of attacker-controlled scripts.
cwd: process.env.PROJECT_ROOT || process.cwd()
The skill creates a persistent executable script (.crabshell/verification/run-verify.js) on disk with no checksum, signature, or integrity verification. This file persists across sessions and can be modified by other processes or attackers to establish persistent malicious execution.
Create `.crabshell/verification/run-verify.js`: ... // Auto-generated verification runner
The only command restriction is a prose rule stating 'Destructive commands (rm, drop) PROHIBITED.' This is enforced only by LLM instruction following, not by any technical allowlist or blocklist in the runner script itself. Bypass via obfuscation (e.g., `$(rm ...)`, aliases, encoded commands) is trivial.
**Timeout safety.** Default 30s. Destructive commands (rm, drop) PROHIBITED.
The skill creates and modifies `.crabshell/verification/manifest.json` and `run-verify.js`. If an attacker can influence the 'IA item in the current session' or 'user input' used to populate these files, they can inject malicious commands or logic that the agent will later execute, effectively poisoning the agent's operational knowledge base.
Create `.crabshell/verification/manifest.json` (line 60); For each IA item in the current session, create a verification entry: (line 65); Create entry with user input (IA, type, command, expected) (line 160)
The manifest.json file is treated as a persistent, authoritative source of truth for commands to execute. If an attacker can write to .crabshell/verification/manifest.json (e.g., via supply chain, another skill, or social engineering), malicious commands will be persistently executed every time `/verifying run` is invoked.
**Manifest is source of truth.** All entries live in `manifest.json`. ... Read `.crabshell/verification/manifest.json`.
The skill spawns multiple sub-agents (Work Agent and Review Agent via Task tool) whose prompts incorporate project-derived data (directory paths, runtime analysis results). If the project contains adversarial content (e.g., in filenames, README, or code comments), it could inject instructions into sub-agent prompts, constituting indirect prompt injection.
Launch a Work Agent (Task tool) to determine: ... Launch a Review Agent (Task tool, SEPARATE from Work Agent) to verify the analysis independently.
The skill instructs the orchestrator to autonomously cross-reference two agent outputs and determine 'discrepancies are findings' without requiring human confirmation of the interpretation. This unbounded autonomous reasoning over externally-sourced data (project files) could be exploited to cause the agent to take unintended actions based on fabricated discrepancies.
After Review Agent completes, the Orchestrator cross-references RA findings against WA Project Analysis — discrepancies are findings.
The Work Agent reads the project environment (files, commands, entry points) and appends findings to agent context. Malicious content embedded in project files (package.json, README, source files) could inject instructions into the agent reasoning pipeline when the analysis results are consumed by the orchestrator or subsequent agents.
Work Agent appends results as: ## Project Analysis - Runtime: {type} - Entry points: {list} ...The skill states 'Destructive commands (rm, drop) PROHIBITED' as a rule. However, the underlying `execSync` mechanism does not technically enforce this, relying on a semantic constraint. An attacker could attempt to bypass this policy by crafting destructive commands that are not explicitly `rm` or `drop`, or by relying on the agent to overlook this rule.
Destructive commands (rm, drop) PROHIBITED. (Rule 5, line 175)
The 'document-first rule' instructs the agent to write verification results to project documents using the Edit tool BEFORE reporting to the human. This pattern could be used to commit attacker-influenced content to persistent project documents without human review of what is being written.
**Document-first rule:** If this verification run was invoked from within a T or P document context, append the P/O/G results to that document's verification section using the Edit tool FIRST. After the document is updated, report the summary in conversation.
[](https://mondoo.com/ai-agent-security/skills/github/ZipperBagCoffee/crabshell/verifying)<a href="https://mondoo.com/ai-agent-security/skills/github/ZipperBagCoffee/crabshell/verifying"><img src="https://mondoo.com/ai-agent-security/api/badge/github/ZipperBagCoffee/crabshell/verifying.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/ZipperBagCoffee/crabshell/verifying.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.